Search code examples
elasticsearchdata-access-layeraccess-control

Elasticsearch: private user documents

We're considering using Elasticsearch for our webservice. Since ES operates at a low level, for authentication and authorization there has to be some layer above it. I see Shields which apparently can control on a roles-based level what a user, and admin, a developer etc. can do in the search index. What I could not find, however, is how to control data access on a user level: Every user has to have access to all public documents plus his/her private ones.

Is there an ES plugin/paradigm that handles this?

Solution

  • The idea with Shield is to have a user group in the indexed document:

    {
  "text":"Document 1 is public",
  "user_group": ["public"]
}
{
  "text":"Document 2 is restricted",
  "user_group": ["restricted"]
}

    Then you can force a filter to be applied for a specified user group

    # For users in group public
{"term" : {"user_group" : "public"}}

# For users in group restricted (can see public as well)
{"terms" : {"user_group" : ["public","restricted"]}}

    Elasticsearch 2.0 / Shield 2.0 has improved Document level security. Prior to that you were forced to use Index Aliases.

    SearchGuard (a Shield alternative) behaves likes Shield: dlsfilter binds a user group with filter.

    In both cases, binding a user to a document might be a difficult (impossible?) task, because everything is based on user groups/roles, not individual users. You could generate a group specific to each user though. Each time you add a user, it will force you to add a user group, and configure its specific grants.